Из коробки сценарий getTGT[.]py конечно же не работает, кто бы мог подумать (Рис. 1).

Почему-то FreeIPA думает, что номер операции (aka application tag) EncASRepPart это 26 (хотя в RFC он 25). Другие люди прикола тоже не оценили.

Если изменить спеку ASN.1, как того хочет ИПА, getTGT[.]py начинает работать (Рис. 2). Удобно, что Overpass-the-Key для этой темы тоже робит.

diff --git a/impacket/krb5/asn1.py b/impacket/krb5/asn1.py
index 24963824..393ac9bb 100644
--- a/impacket/krb5/asn1.py
+++ b/impacket/krb5/asn1.py
@@ -283,9 +283,9 @@ class EncKDCRepPart(univ.Sequence):
         _sequence_optional_component('key-expiration', 3, KerberosTime()),
         _sequence_component('flags', 4, TicketFlags()),
         _sequence_component('authtime', 5, KerberosTime()),
-        _sequence_optional_component('starttime', 6, KerberosTime()),
+        _sequence_optional_component('starttime', 6, KerberosTime()),   # can be empty, so worth try-excepting
         _sequence_component('endtime', 7, KerberosTime()),
-        _sequence_optional_component('renew-till', 8, KerberosTime()),
+        _sequence_optional_component('renew-till', 8, KerberosTime()),  # can be empty, so worth try-excepting
         _sequence_component('srealm', 9, Realm()),
         _sequence_component('sname', 10, PrincipalName()),
         _sequence_optional_component('caddr', 11, HostAddresses()),
diff --git a/impacket/krb5/ccache.py b/impacket/krb5/ccache.py
index 915ea268..01c7f2f8 100644
--- a/impacket/krb5/ccache.py
+++ b/impacket/krb5/ccache.py
@@ -25,6 +25,7 @@ from six import b, PY2
 
 from pyasn1.codec.der import decoder, encoder
 from pyasn1.type.univ import noValue
+from pyasn1.error import PyAsn1Error
 from binascii import hexlify
 
 from impacket.structure import Structure
@@ -493,9 +494,12 @@ class CCache:
 
         credential['time'] = Times()
         credential['time']['authtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['authtime']))
-        credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['starttime']))
+        try:
+            credential['time']['starttime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['starttime']))
+        except PyAsn1Error:
+            pass
         credential['time']['endtime'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['endtime']))
-        credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['renew-till']))
+        #credential['time']['renew_till'] = self.toTimeStamp(types.KerberosTime.from_asn1(encASRepPart['renew-till']))
 
         flags = self.reverseFlags(encASRepPart['flags'])
         credential['tktflags'] = flags
diff --git a/impacket/krb5/constants.py b/impacket/krb5/constants.py
index 60f1776c..581b5007 100644
--- a/impacket/krb5/constants.py
+++ b/impacket/krb5/constants.py
@@ -42,7 +42,7 @@ class ApplicationTagNumbers(Enum):
     KRB_SAFE       = 20
     KRB_PRIV       = 21
     KRB_CRED       = 22
-    EncASRepPart   = 25
+    EncASRepPart   = 26  # WTF ??? https://mailman.mit.edu/pipermail/kerberos/2006-July/010040.html
     EncTGSRepPart  = 26
     EncApRepPart   = 27
     EncKrbPrivPart = 28